Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

FTP Inspect on ASA 5520

Status
Not open for further replies.

GremlinSlayer

Technical User
Dec 11, 2006
3
US
can i implement ftp inspect only on one vpn tunnel and not affect other ftp traffic? i am nat'n the ip and the remote ftp end is rejecting it per the source ip not matching the nat'd ip. i was told to use ftp inspect but i dont want to create more problems. our default is active ftp

this is my concern from cisco's pdf:

If you disable FTP inspection engines with the no inspect ftp command, outbound users can start
connections only in passive mode, and all inbound FTP is disabled.

any suggestions?
 
What you want is a modular policy. Give this a read -
I have found another article that says that it cannot be done in an ipsec environment (I assume that it means applying it to the tunnel itself) but if you base the policy on destination IP and apply it to the inside interface I believe it would work.

Here is a good description of passive vs. port mode ftp.


Brent
Systems Engineer / Consultant
CCNP, CCSP
 
I applied this config and it is currently working with port/active mode - no problems thus far

access-list ftp_inspection permit tcp host x.x.x.x x.x.x.x 255.255.255.248 eq ftp
class-map inspect_ftp
match access-list ftp_inspection


policy-map global_policy
class inspect_ftp
inspect ftp

service-policy ftp_policy interface inside

thanks Brent
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top